Splunk Search

How can I alter the searches being executed by *NIX app?

New Member

Based on other questions submited, it looks like I might be able to change the inputs.conf file but need to make sure.

what I want to do is limit the data pulled in on 'top' & 'ps'. I want to add " | HEAD 20". If I'm reading this right, I can add that command on the line following 'source = top' as I have below. is this correct? Is there a better way to accomplish this? any pointers would be appreciated.

interval = 60
sourcetype = top
| head 20 (<==== new entry)
source = top
index = os
disabled = 1

Tags (1)
0 Karma


What you're altering there isn't a search, it's an input stanza. So that syntax isn't going to do anything functional. If you want to modify what those scripts output, you'll need to go into $SPLUNK_HOME/etc/apps/unix/bin/ and then modify the relevant script.

As to what to change in the script to accomplish what you want, that depends on the platform. You're working with shell scripts there, not Splunk specific language.

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...